Cybercrime intelligence at the core

See earlier. Act with context.

Identify business fraud, external digital risk and API security risk earlier, then turn relevant evidence into decisions through product platforms, risk data and professional services.

Talk to our team Explore solutions

Product platforms · Risk data · Professional services

01Risk signals02Connected context03Actionable evidence

Threat Hunter product interface showing high-value intelligence with redacted demonstration data — 01Risk signals02Connected context03Actionable evidence

Start with the problem

Which risk does your team need to control?

Begin with the business condition you recognize, then see the product, data and specialist components that fit.

All solutions

Business fraud

Business Fraud Protection

See how fraud is being prepared outside your systems, connect related activity and strengthen the controls protecting critical workflows.

See attack preparationValidate critical controls

Credit fraud

Credit Fraud Protection

Bring external fraud intelligence into application, approval and post-loan work to identify organized behavior that isolated applications may hide.

Monitor intermediaries and groupsFollow changes over time

Financial risk control

China Fraud-Linked Fund Risk Sensing

External risk context on accounts, customers and merchants along the fraud-linked fund chain, for institutions operating in mainland China.

Sense receiving-account riskIdentify laundering merchants and corporate accounts

Data leakage

Data Leakage Detection and Response

Find enterprise, employee and customer data beyond the organization’s boundary, verify what matters and move confirmed risks into response.

Find relevant exposureMove confirmed risks into response

Phishing & impersonation

Phishing, Impersonation and Brand Protection

Discover digital objects that imitate your official presence, verify the threat and coordinate a traceable response.

Discover suspected impersonationCoordinate a traceable response

Account takeover

Account Takeover and Credential Exposure Protection

Find externally exposed credentials, match relevant accounts within an authorized scope and support proportionate account protection.

Find credential exposureSupport proportionate protection

Global business risk

Global Business Risk Protection

Give cross-market registration, account, payment and promotion teams risk context that reflects local resources and evolving fraud methods.

Start with the target marketValidate market-specific controls

View all 7 solutions

Products & services

Three operating models for different risk tasks

Platforms support continuous operations, risk data informs decisions, and professional services address defined specialist tasks.

View products & services

Product Platforms

Continuous visibility and operational workflows for recurring risk.

Anti-Fraud Intelligence PlatformTrack external fraud resources, tools, channels and organized activity before they surface as isolated account or transaction events.SWARM RADAR | Coordinated BehaviorIdentify coordinated activity around a public incident, trace related clusters and deliver reviewable investigation evidence.Data Leakage Intelligence PlatformContinuously identify enterprise, employee and customer data exposed, distributed or traded beyond the organization’s boundary.Phishing & Brand Impersonation Intelligence PlatformContinuously discover suspicious domains, sites, apps and social accounts that imitate official customer touchpoints.Account Takeover Intelligence PlatformMonitor external credential exposure and match relevant accounts within the customer’s authorized scope.API Security PlatformContinuously discover changing API assets, map sensitive-data flows and identify interface defects from mirrored traffic.

Risk Data

Explainable external signals for real-time decisions and investigations.

Phone Number Risk IntelligenceAdd explainable external risk context to phone numbers used in registration, login, promotion, transaction and credit workflows.IP Risk IntelligenceExplain the network environment behind an IP address, including relevant proxy, hosting and external abuse context.Email Risk IntelligenceAdd email-type, external exposure and relevant risk context to identity and account decisions.Mainland China Bank Card Risk IntelligenceAdd external gambling, fraud and money-laundering risk signals to bank-card review in mainland China.Global Compromised Card IntelligenceAdd external card-exposure signals to cross-border payment, card-testing, fraud and chargeback workflows.

Professional Services

Expert validation and response for clearly scoped risk objectives.

Credit Fraud Intelligence ServiceInvestigate external fraud intermediaries, identity packaging, fraudulent channels and organized activity across the credit lifecycle.Anti-Fraud Blue Team Validation ServiceTest whether agreed business controls protect critical objectives in realistic domestic or international fraud scenarios.Digital Risk Takedown & Response ServiceVerify external digital risks, preserve evidence, coordinate removal and track recurrence across the agreed response scope.

How intelligence supports action

From detecting risk to sustaining the response

This is a shared operating method across offerings, not a claim that every product includes the same service or response action.

Detect

Keep external risk signals visible

Observe changes connected to business workflows, identities, brands, data and external attack activity.

Understand

Connect evidence to impact

Organize risk objects, match rationale, relationships and necessary context so teams can judge priority.

Act

Move findings into the right workflow

Support strategy, review, investigation, account protection, response and governance decisions.

Track

Follow what changes next

Keep risk status, recurrence and material changes visible for sustained operations.

Industry researchGartner · IDC

Included in relevant public industry research

Delivery networkTwo DRRCs

Digital risk response centers in Shenzhen and Chongqing

Service foundation24 × 7 × 365

Continuous risk monitoring and response foundation

Market experienceGlobal customers

Experience across Europe, the Americas and Southeast Asia

Selected customers

Trusted across high-stakes digital operations

Threat Hunter works with teams across financial services, internet platforms, commerce and consumer businesses. Selected customer brands are shown with authorization.

Threat research

Turn frontline observations into reusable judgment

Explore selected public research on the threat economy, digital risk and changing attack patterns.

Explore research

Featured research · Cybercrime research

October 2026 Risky IP Insights: 50%+ Vanish Within a Week

Drawing on 49 million active risky IPv4 addresses observed between September 27 and October 25, 2026 (77% on residential broadband), Threat Hunter quantifies four operational blind spots in static IP defense: newly observed risky IPs have a ~5-day half-life (32% last 1 day, 42.3% remain on Day 7), requiring a 7–14 day residential ban TTL; 7-day rolling blocklist coverage drops from 84.2% same-day to 79.5% after a 1-day lag and 67.1% after a 7-day lag, while 15.8% of daily risky IPs are first-time appearances; the 14% persistent IPs active ≥15 days drive 63% of risky activity; and 89% of risky IPs in China are hijacked shared home routers requiring step-up verification, while weekly active risky IPs outside China rose 29% in late October to 20.66 million.

Read the publication

Threat Research

Cents per Smear

One script, five infant-formula brands named at once. Product-line nicknames instead of brand names, questions instead of claims, and RMB 0.25–0.4 (US$0.04–0.06) per ordinary negative comment. Threat Hunter tracked 613 paid attack tasks in September 2026. What they show is a piece-rate business built to look like genuine customer experience.

Business security research

Mastercard Cross-Border Unauthorized Transaction Analysis

As of 29 September 2026, Threat Hunter reviewed 169 public posts and coded 143 transaction amounts. The assessment focuses on attackers obtaining Apple Pay device PANs (DPANs) in bulk and submitting them into card-not-present channels where token scope and cardholder authentication were not enforced.

Start with the business risk

See the risk earlier. Move the right evidence into action.

Tell us what is happening, which workflow is affected and what your team already observes. We will help define a practical next step.

Talk to our team